Skip to content

How To Blog

  • The Best Apple Watch Faces for Health and Fitness 2022 Apple Watch
  • Best ti-36x pro scientific calculator 2020

    Best ti-36x pro scientific calculator 2020

  • How to Share & Repost Images on Instagram Web Site Tips
  • Best cool calculator 2020

    Best cool calculator 2020

  • how to Fix Spotify web player is not working Computer Tips
  • 7 Best Christmas Gifts for Sight Impaired Techies Gadgets
  • Windows 7/8/10 – How to Delete Files Protected by TrustedInstaller Windows 7
  • How to Download and Install iCloud on Windows 10 Computer How-To

Using Wireshark to Sniff an SMB transmission

Posted on October 9, 2020 By blog_786 No Comments on Using Wireshark to Sniff an SMB transmission

Ever wonder what happens under the hood when you connect to a Windows share? There is one easy way to find out. Use a packet sniffer like Wireshark.

What is Wireshark?

Wireshark is an easy-to-install and easy-to-use packet capture tool that is supported on both Windows and Linux. On Windows, Wireshark uses the Windows Pcap module as its primary mechanism for capturing packets. Wireshark sits on top of Pcap to provide an easy-to-use interface and packet filter.

Using Wireshark to Sniff an SMB transmission

The easiest way to monitor packets between two machines is to simply install Wireshark on one of the two machines and then configure a filter to view traffic. In this example, we will monitor traffic between a Windows 10 client computer and a Windows 2012 server.

Create a file share

First, we’ll set up a share on a Windows 2012 machine. On a Windows 2012 machine, create a new folder and name it “Share.” Right click and select Properties. Go to the Sharing tab and select Share. Allow a user with administrative rights to access the share with read and write access. In this case, the administrator is already the owner of the shared folder.

Using Wireshark to Sniff an SMB transmission

Confirm that your share is listening with the net share command.

Using Wireshark to Sniff an SMB transmission

Client setting

Then, on a Windows 10 machine, we will connect to our newly created network share using the command line.

Using Wireshark to Sniff an SMB transmission

After confirming the connection to the share, it’s time to see what happens. Let’s install Wireshark on a Windows 10 computer. Wireshark is available for download from www.wireshark.org In this example, we will use Wireshark-win64-2.6.6.exe. Just click Next and select all the defaults in the setup wizard.

When launching Wireshark, the first step is always to launch the capture on the designated interface. From the Wireshark menu go to Capture | Parameters. Select the desired listening interface and start capturing. In this case, we only have one network adapter to choose from.

Using Wireshark to Sniff an SMB transmission

After listening, you will see all traffic on the interface.

Using Wireshark to Sniff an SMB transmission

Traffic Filter

In order to see only the traffic participating in the SMB exchange, we need to configure some filters. If you don’t know all the filtering commands, Wireshark has a user-friendly graphical interface that you can use to customize your filters. In the top bar next to the search bar, select Expression. The “Wireshark – Display Filter Expression” window opens.

Using Wireshark to Sniff an SMB transmission

In this window, navigate through the protocol to find the appropriate filter. In this case, the simplest introductory filter for narrowing our traffic is restricting traffic by IPv4 address.

We will go to the IPv4 address and set ip.addr == 192.168.31.201, which is the IP address of the SMB share. The same command can simply be entered directly into the search bar if you are a more experienced Wireshark user. Traffic is now only limited to traffic between our client and the Windows 2012 server.

Let’s see if we can get more information from this capture. Let’s delete the share first. On Windows 10, run Command Prompt as administrator and type net use \ 192.168.31.201 share delete. Below is an example of a TCP stream during deletion. This time, a little more information is provided in the open.

Using Wireshark to Sniff an SMB transmission

Then we will restart the entire connection from the beginning to make sure our credentials are protected. First, confirm that the session is not established by running netstat and filtering out any ESTABLISHED sessions. Then reconnect to the share with explicit credentials and then follow TCP flow.

Using Wireshark to Sniff an SMB transmission

Hooray! No passwords in clear text. However, I can see the username. It might be time to move to SMBv3.

Using Wireshark to Sniff an SMB transmission

This simple example demonstrates how to use Wireshark to monitor network connections. Wireshark can be used to listen for all network traffic to troubleshoot connectivity issues, or to determine if there is clear text in a packet exchange, which should be further protected. Wireshark is another tool that can be added to your security arsenal. Happy sniffing!

How-To Tags:Client setting, Create a file share, Traffic Filter, Using Wireshark to Sniff an SMB transmission, What is Wireshark?

Post navigation

Previous Post: Enable Encryption for Microsoft SQL Server Connections
Next Post: How to Configure IPSec on Windows

Related Posts

  • Windows 10 network file sharing to android How-To
  • How to Return a Book on Audible App How-To
  • How To Change IP Address in Windows How-To
  • Enable Game Mode to Smooth Out Performance in Windows 10 How-To
  • How To Preserve & Extend Your Device’s Battery Life How-To
  • How to Fix “Microsoft Register Server has Stopped Working” How-To

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Archives

  • May 2023
  • April 2023
  • November 2022
  • September 2022
  • August 2022
  • July 2022
  • June 2022
  • May 2022
  • April 2022
  • March 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • August 2021
  • July 2021
  • March 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • December 2019
  • July 2019
  • May 2019
  • April 2019
  • January 2019
  • December 2018
  • November 2018
  • October 2018
  • September 2018
  • August 2018

Categories

  • Amazon Web Services
  • Apple Watch
  • Computer Tips
  • Cool Websites
  • Free Software Downloads
  • Gadgets
  • Gaming
  • General Software
  • Google Software/Tips
  • Hardware
  • Help Desk
  • How-To
  • iOS
  • iPad
  • iPhone
  • Linux
  • Linux Tips
  • macOS
  • MS Office Tips
  • Networking
  • Office Tips
  • OS X
  • Product Reviews
  • Reviews
  • Safari
  • Smart Home
  • Smartphones
  • Software Reviews
  • technology
  • text
  • Tools Review
  • Troubleshooting
  • Tutorials
  • Uncategorized
  • Urdu Books PDF
  • Web Site Tips
  • Windows
  • Windows 10
  • Windows 7
  • Wordpress

Recent Posts

  • How to transfer Steam game to another drive
  • How to fix google backup and sync not signed
  • Top Best Guitar Apps for Android 2021
  • 5 Best Professional Photo Recovery Software for Android 2021
  • how to crosspost on reddit 2021

Recent Comments

  1. How to Minimize a Windows Program to the System Tray 2023 - How To Blog on How to Fix System Tray or Icons Missing in Windows 10
  2. How can I unlock my Macbook using Apple Watch - How To Blog on How to Install Chrome OS on Macbook or iMac
  3. 4k hdmi switch with optical out - How To Blog on Is A Gaming PC Really More Expensive Than A Console?
  4. online video maker with music and pictures 2023 - How To Blog on 6 Video Editing Tips For Beginners
  5. 5 New Ways to Clean Electronics Safely - How To Blog on How to Clean Your Computer Properly, Inside and Out
  • How To Rip Your DVDs & Blu-Rays Effortlessly With MakeMKV Tools Review
  • How to Fix “Cannot renew IP address” in Windows Networking
  • Best calculator ribbons 2020 black
  • How to Connect Your Xbox to Your Windows PC How-To
  • How to scan Google Drive from your phone How-To
  • The Best Digital Payment Services 2022? Computer Tips
  • What is the Best Time to Post on TikTok in 2022? technology
  • The Complete Beginner’s Guide To Stringify Smart Home

Copyright © 2023 How To Blog.

Powered by PressBook News WordPress theme

Go to mobile version